Fortinet FortiAnalyzer CVE-2026-23705

Requires an authenticated session on the FortiAnalyzer or FortiManager management interface; the description indicates a low-privileged user suffices, while the vendor CVSS vector marks PR:H - so at minimum valid credentials on the appliance are needed (no UI:N interaction from a victim required). Affected deployments: FortiAnalyzer 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2; FortiManager 7.6.0-7.6.4, 7.4.0-7.4.6, and all 7.2. The primary limiting factor is the authentication prerequisite - exposure of the management plane only to trusted administrators substantially reduces attack surface; there are no known default-configuration or feature-toggle preconditions beyond having an account.

This is an authenticated SQL injection (CWE-89) leading to arbitrary command execution in Fortinet FortiAnalyzer and FortiManager management platforms. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) signals network-reachable, low-complexity exploitation with full confidentiality, integrity and availability impact, but requiring high privileges. CONFLICT TO VERIFY: the CVSS vector encodes PR:H (high privilege), yet the description explicitly states a 'low privileged user' can exploit it - these disagree, and a PR:L reading would materially raise the real-world score (~8.8). Treat the privilege prerequisite as uncertain and confirm with Fortinet FG-IR-26-178. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is currently no evidence of active exploitation or weaponization. Net assessment: a genuinely serious flaw (post-authentication path to arbitrary command execution on security-management infrastructure that aggregates logs and pushes policy to downstream devices), but exploitation depends on an attacker already holding a valid account, which tempers immediacy relative to an unauthenticated RCE. Fortinet appliances are frequent targets, so patching should be prioritized despite the absence of KEV/POC signals.

An attacker who holds a valid low-privilege account (or has phished/reused credentials) on a FortiAnalyzer or FortiManager web/management interface sends a crafted request whose input is unsafely concatenated into an SQL command, injecting SQL that escalates into arbitrary command execution on the appliance. Because these systems centralize logs and manage policy for many downstream Fortinet devices, a single compromise can expose sensitive data and pivot across the managed fleet. No public exploit identified at time of analysis, so exploitation currently requires original research.